Huge macOS Bug Allows Root Login Without a Password. Here's the Fix

BGR staff tested the bug on several devices running the most recent version of MacOS High Sierra, and were able to log in as the root user easily, with access to all other user accounts.

The flaw was publicized Tuesday on Twitter by Lemi Orhan Ergin, a software engineer based in Turkey. It also allows for anyone to login to a machine even immediately after reboot. In order to exploit the issue, a bad guy would need physical access to your Mac.

We're certain Apple will have a patch for this vulnerability soon, but for now users can patch things up themselves by enabling a root account with a password.

As of now, it's unclear how something like this could have slipped past Apple and Apple tends to keep errors like this under wraps and doesn't disclose much about them.

Ben Johnson, the chief technology officer of Obsidian Security and a former U.S. National Security Agency computer scientist, described the flaw to IBT as "a hacker's dream".

An attacker can for instance enter root as the username in the users and groups preferences setting, leaving the password field blank, and clicking on the unlock button. Click the lock to make changes and enter the administrator name and password. (The company maintains an invite-only bug bounty program.) Despite its incredibly alarming simplicity, The Verge is not reproducing the steps to bypass High Sierra's login screen here. Enter the administrator name and password.

Despite suggestions that the flaw can be mitigated by disabling the computer's guest account, this will not work - it simply restarts the computer with Safari the only application running.

RELATED NEWS

Reverend Al Sharpton visits rapper Meek Mill in prison
The ruling came after both Mill's probation officer and a prosecutor recommended that the Philadelphia-native not be jailed. Habeas corpus motions are typically a last resort after a criminal defendant has exhausted other avenues of appeal. 11/29/2017

Marvel Releases Teaser Poster For 'Avengers: Infinity War'
The fourth " Avengers " movie will be a key inflexion point in the Marvel Cinematic Universe , according to producer Kevin Feige. In case you haven't noticed, the marketing campaign for Avengers: Infinity War began this week. 11/29/2017

Coral transplant raises Barrier Reef survival hopes
When taking measures for restoring damaged coral reef , there is another thing that needs to be taken into consideration. The effect of climate change and rising sea temperature has drawn global focus on the Great Barrier Reef. 11/29/2017

Uber-Waymo Trial Delayed Again After Shocking New Allegations
The evidence at the heart of the postponement was a letter from a former Uber security analyst's attorney to an Uber lawyer. The latest bombshell to drop on Uber came as the company tried to complete a $10 billion sale of its privately held stock. 11/29/2017

YouTube deletes 150K videos that led to ad boycott
If you don't know, YouTube Go is a lightweight version of the YouTube with more features such as video downloading and more. Its official policy states that posting such content "will immediately result in an account termination". 11/29/2017